In May 2026, the FTC sent warning letters to a dozen websites offering “nudify” services — tools that use AI to generate fake nude images from ordinary photos — threatening civil penalties of more than $53,000 per violation. The letters mark the first wave of federal enforcement under the TAKE IT DOWN Act, a law most people have never read but that now directly affects what happens if your photo is misused this way.
If you searched “take it down act explained” or “nudify app law” after seeing this in the news, here’s what the law actually does, what it doesn’t do, and what to do if it happens to you.
What the TAKE IT DOWN Act Actually Requires
The TAKE IT DOWN Act is a federal law targeting nonconsensual intimate images (NCII), including ones generated or altered by AI. It was signed in May 2025, and the enforcement deadline for online platforms — the part that actually has teeth — took effect a year later, in May 2026.
The core mechanic is a 48-hour takedown window. Once a covered platform receives a valid removal request for a nonconsensual intimate image, it has 48 hours to take it down. This applies whether the image is a real photo shared without consent or an AI-generated fake — a “nudify” output — built from a real photo of an identifiable person.
The law also criminalizes the distribution of this content at the federal level, which matters because enforcement previously relied on a patchwork of state laws that varied widely in coverage and penalty.
Why the FTC Is Going After “Nudify” Sites Specifically
Nudify apps are a distinct category from general deepfake tools: they’re built and marketed specifically to remove clothing from a photo of a real, identifiable person without that person’s consent. Unlike a face-swap tool that has legitimate creative uses, a nudify tool’s primary function is the nonconsensual content the new law targets.
The FTC’s May 2026 warning letters allege that the targeted sites failed to build in the takedown infrastructure the law requires — no clear process for someone to request removal, no compliance with the 48-hour window. That’s a meaningful distinction: the law doesn’t just ban the content, it requires platforms to have a working removal mechanism, and the first enforcement wave is going after sites that apparently don’t have one.
States Are Moving Faster Than Federal Enforcement
While the federal law sets a floor, several states have gone further by targeting the apps themselves rather than just the distribution platforms.
Minnesota became the first state to pass a dedicated ban on “nudification” technology, with its Senate passing the bill 65-0 before the governor signed it in May 2026. The law addresses the tools that generate this content, not just the sites that host the results — closing a gap the federal law leaves more ambiguous.
Advocacy groups have since pushed other state attorneys general to pursue similar action, arguing that federal enforcement alone moves too slowly to keep pace with how quickly new nudify sites appear once old ones are shut down or fined.
What the Law Doesn’t Fix
It’s worth being clear-eyed about the limits here, because a new law can create a false sense that the problem is solved.
Takedown isn’t prevention. The 48-hour window applies after content has been created and reported — it does nothing to stop a nudify tool from generating the image in the first place, or to prevent someone from saving a copy before a takedown request is processed.
Enforcement targets platforms, not necessarily the people who use them. Warning letters and fines apply to the websites and services hosting nudify tools. Identifying and prosecuting the individual who generated and distributed a specific image is a separate, harder process that the law doesn’t streamline.
New sites appear faster than old ones get shut down. Nudify tools are cheap to build and host. A site fined or shut down under FTC enforcement can be functionally replaced by a near-identical one within days, which is part of why advocates are pushing for action against the underlying AI models and app stores, not just individual websites.
The source material is usually an ordinary photo. Nudify tools don’t need a special kind of input — a normal, fully-clothed photo from a social media profile, a dating app, or a public album is sufficient. The law addresses what happens to the output; it does nothing about how exposed the input already is.
What to Do If You’re Targeted
If you discover that your likeness has been used in a nonconsensual deepfake or nudify-generated image, the practical steps now have more legal backing behind them than they did a year ago:
1. Document everything before reporting. Screenshot the content, the URL, and any account or profile information associated with it, before it potentially gets taken down — you may need this record for a platform report, a law enforcement report, or both.
2. File a takedown request directly with the platform. Under the TAKE IT DOWN Act, a covered platform must act within 48 hours of a valid request. Most major platforms now have a dedicated reporting flow for nonconsensual intimate imagery — look for it specifically rather than using a generic “report content” button, since NCII reports are often prioritized differently.
3. Report to the FTC if the platform doesn’t comply. If a platform misses the 48-hour window or has no working removal process, that’s the exact failure the FTC’s 2026 enforcement actions are targeting. Filing a complaint contributes to the pattern regulators use to justify further action.
4. Check state-specific options. If you’re in a state with its own nudification ban, like Minnesota, you may have an additional avenue for legal action against the tool or its operator directly, not just the hosting platform.
5. Consider a cease-and-desist or legal consultation if the content keeps reappearing. A single takedown doesn’t guarantee the content stays down — organizations like the Cyber Civil Rights Initiative provide free resources and, in some cases, direct support for ongoing harassment cases.
The Best Defense Is Still Reducing What’s Out There
Federal and state law now gives victims real recourse after the fact. But the most effective protection is still reducing how much identifiable, accessible photo material exists for these tools to use as input in the first place — the same lesson that applies to deepfakes generally.
This is where it’s worth being deliberate about where your personal photos actually live. A photo sitting in a private, encrypted archive isn’t part of the pool of public, scrapeable material a nudify tool draws from. A photo on a public social media profile, an old dating app account, or a forgotten public album is.
daftei stores your photos as private files — encrypted in transit with TLS 1.3 and at rest with AES-256, never analyzed for AI training, never shared with advertisers, and never displayed publicly by default. It doesn’t make you immune to misuse of photos that are already public elsewhere, but it does mean the personal archive you keep going forward doesn’t add itself to that exposed pool.
A Law in Its First Year
The TAKE IT DOWN Act’s 2026 enforcement wave is still in its early months. How well it works will depend on whether the FTC keeps pace with new nudify sites as they appear, whether more states follow Minnesota’s lead in banning the tools themselves, and whether the 48-hour takedown requirement holds up against platforms that try to slow-walk compliance.
For now, the practical takeaway is straightforward: there’s a real legal mechanism to get this content removed, faster than there was a year ago — and the strongest move you can make before you ever need it is being thoughtful about which of your photos are public, and which are private.